Update! Got it working. Turns out it matters where in /etc/MailScanner/filename.rules.conf you add your entries - I had been adding the exception for doc.pdf after "deny all other double file extensions", and moving the entry right above it fixed the issue